Genuine PDF Forgeries (Extended Abstract)

Jakob Heher; Emanuel Pichler; Stefan More

Genuine PDF Forgeries (Extended Abstract)

Jakob Heher^*
, Emanuel Pichler
, Stefan More

^*Corresponding author for this work

Research output: Working paper › peer-review

Abstract

Signed PDF documents have legally binding value.
We introduce a novel class of attack focused on human factors in signature validation; exploiting a disconnect between machine-verifiable signer certificates and human-visible signature badges. We analyze our attack against 24 PDF reader applications across three operating systems and the web.
We find that the majority of eIDAS-validating readers, including Adobe Acrobat Reader, are susceptible. We design countermeasures, and implement one of them into the open source PDF reader Zathura.

Original language	English
Place of Publication	Copenhagen, Denmark
Publication status	Accepted/In press - 4 Jun 2025

Publication series

Name	20th IFIP Summer School on Privacy and Identity Management 2025

Fields of Expertise

Information, Communication & Computing

1 Finished
1 Active

EU - LICORICE - reLIable and sCalable tOols foR self-sovereIgn identity and data proteCtion framEwork
Tauber, A. (Project manager on research unit)
1/10/24 → 30/09/27
Project: Research project
A-SIT - Secure Information Technology Center Austria
Posch, R. (Project manager), Oswald, M. E. (Other function), Payer, U. (Other function), Neuherz, E. (Other function), Ivkovic, M. (Attendee), Tauber, A. (Attendee), Reiter, A. (Attendee), Zefferer, T. (Attendee), Kreuzhuber, S. (Attendee), Rössler, T. (Other function), Mangard, S. (Attendee), Bratko, H. (Other function), Dietrich, K. (Attendee), Stranacher, K. (Attendee), Bonato, M. (Other function), Bauer, W. (Attendee), Orthacker, C. (Attendee), Wolkerstorfer, J. (Attendee), Zwattendorfer, B. (Attendee), Aigner, M. J. (Other function), Scheibelhofer, K. (Other function), Suzic, B. (Attendee), Knall, T. (Other function), Leitold, H. (Coordinator), Bratko, D. (Attendee), Dominikus, S. (Attendee), Lipp, P. (Attendee), Marsalek, A. (Attendee), Reimair, F. (Attendee), Feichtner, J. (Attendee) & Teufl, P. (Attendee)
21/05/99 → 31/12/24
Project: Research area

1 Talk at conference or symposium

Genuine PDF Forgeries
Heher, J. (Speaker) & More, S. J. (Contributor)
20 Aug 2025
Activity: Talk or presentation › Talk at conference or symposium › Science to science

1 Conference paper

Genuine PDF Forgeries
Heher, J., Pichler, E. & More, S., Dec 2025, (Accepted/In press) IFIP Advances in Information and Communication Technology: Privacy and Identity Management. Springer Science+Business Media
Research output: Chapter in Book/Report/Conference proceeding › Conference paper › peer-review

Cite this

@techreport{49d10c05c52141119cdaff9415560579,

title = "Genuine PDF Forgeries (Extended Abstract)",

abstract = "Signed PDF documents have legally binding value. We introduce a novel class of attack focused on human factors in signature validation; exploiting a disconnect between machine-verifiable signer certificates and human-visible signature badges. We analyze our attack against 24 PDF reader applications across three operating systems and the web. We find that the majority of eIDAS-validating readers, including Adobe Acrobat Reader, are susceptible. We design countermeasures, and implement one of them into the open source PDF reader Zathura.",

author = "Jakob Heher and Emanuel Pichler and Stefan More",

year = "2025",

month = jun,

day = "4",

language = "English",

series = " 20th IFIP Summer School on Privacy and Identity Management 2025",

type = "WorkingPaper",

}

TY - UNPB

T1 - Genuine PDF Forgeries (Extended Abstract)

AU - Heher, Jakob

AU - Pichler, Emanuel

AU - More, Stefan

PY - 2025/6/4

Y1 - 2025/6/4

N2 - Signed PDF documents have legally binding value. We introduce a novel class of attack focused on human factors in signature validation; exploiting a disconnect between machine-verifiable signer certificates and human-visible signature badges. We analyze our attack against 24 PDF reader applications across three operating systems and the web. We find that the majority of eIDAS-validating readers, including Adobe Acrobat Reader, are susceptible. We design countermeasures, and implement one of them into the open source PDF reader Zathura.

AB - Signed PDF documents have legally binding value. We introduce a novel class of attack focused on human factors in signature validation; exploiting a disconnect between machine-verifiable signer certificates and human-visible signature badges. We analyze our attack against 24 PDF reader applications across three operating systems and the web. We find that the majority of eIDAS-validating readers, including Adobe Acrobat Reader, are susceptible. We design countermeasures, and implement one of them into the open source PDF reader Zathura.

M3 - Working paper

T3 - 20th IFIP Summer School on Privacy and Identity Management 2025

BT - Genuine PDF Forgeries (Extended Abstract)

CY - Copenhagen, Denmark

ER -

Genuine PDF Forgeries (Extended Abstract)

Abstract

Publication series

Fields of Expertise

Projects

EU - LICORICE - reLIable and sCalable tOols foR self-sovereIgn identity and data proteCtion framEwork

A-SIT - Secure Information Technology Center Austria

Activities

Genuine PDF Forgeries

Research output

Genuine PDF Forgeries

Cite this